CVE-2021-35209

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://blog.sonarsource.com/zimbra-webmail-compromise-via-email	Exploit Third Party Advisory
https://wiki.zimbra.com/wiki/Security_Center	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zimbra:collaboration::::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:-::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p1::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p10::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p11::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p12::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p13::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p14::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p15::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p16::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p17::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p18::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p19::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p2::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p3::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p4::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p5::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p6::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p7::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p8::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p9::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:-::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p1::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p10::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p11::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p12::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p2::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p3::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p4::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p5::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p6::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p7::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p8::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p9::::::

History

20 Sep 2021, 18:56

Type	Values Removed	Values Added
References		(MISC) https://blog.sonarsource.com/zimbra-webmail-compromise-via-email - Exploit, Third Party Advisory
CWE	~~CWE-601~~	CWE-918
CVSS	v2 : ~~5.8~~ v3 : ~~6.1~~	v2 : 7.5 v3 : 9.8

08 Jul 2021, 13:53

Type	Values Removed	Values Added
References	~~(MISC) https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories -~~	(MISC) https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - Vendor Advisory
References	~~(MISC) https://wiki.zimbra.com/wiki/Security_Center -~~	(MISC) https://wiki.zimbra.com/wiki/Security_Center - Release Notes, Vendor Advisory
References	~~(MISC) https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 -~~	(MISC) https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 - Release Notes, Vendor Advisory
References	~~(MISC) https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 -~~	(MISC) https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 - Release Notes, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.8 v3 : 6.1
CPE		cpe:2.3:a:zimbra:collaboration:8.8.15:p17:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p1:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p6:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p9:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:-:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p11:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p1:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p13:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p3:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p2:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p16:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p19:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p4:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p6:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p10:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p9:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p7:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p12:::::: cpe:2.3:a:zimbra:collaboration:::::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p18:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p5:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p10:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p15:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p5:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p14:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p3:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p11:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p8:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:-:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p4:::::: cpe:2.3:a:zimbra:collaboration:8.8.15:p12:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p8:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p2:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p7::::::
CWE		CWE-601

02 Jul 2021, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-07-02 19:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-35209

Mitre link : CVE-2021-35209

CVE.ORG link : CVE-2021-35209

JSON object : View

Products Affected

zimbra

collaboration

CWE

CWE-918

Server-Side Request Forgery (SSRF)

9.8 /10